Hacker News Reader

Comment by orliesaurus | Hacker News Reader

Good article! I don't know what you call those new Google captcha, where you have to press "I am not a robot" and then you are given a bunch of images and a question that goes something like: "Select all images that contain cars" Do you consider that a CAPTCHA? Or is it something else? Now that's one system that I would like to see beaten. From the article:

    Yep, it generates 4-letter CAPTCHAs using a random mix of four different fonts.
    And we can see that it never uses “O” or “I” in the codes
    to avoid user confusion.

this seems to be a very simple CAPTCHA system to beat from a ML problem perspective, right?

View on HN

Yep, this is a pretty simple CAPTCHA picked to illustrate a concept for teaching purposes. But more complex CAPTCHA images don't necessarily make anything more secure depending on how the whole system works.

In fact, one of the most effective attacks against Google's ReCAPTCHA is more simple than anything in this article - you just request the audio version of the captcha, feed it to Google's own Speech Recognition API (or a competitor), and give Google back it's own result [1]

[1] https://github.com/eastee/rebreakcaptcha

According to the linked blog, this worked for about a week before Google flagged the IP and started delivering an obfuscated audio challenge that can't be recognized by their own recognition API.

| Do you consider that a CAPTCHA? Yes:"Completely Automated Public Turing test to tell Computers and Humans Apart"

But funny enough, I believe that data is used to help with machine learning to identify the objects, so we are CAPTCHA'ng ourselves into harder and harder CAPTCHA's.

The "I am not a robot" types are interesting because they don't just test you, they monitor your behavior. "If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck."

I would like this NOT to be broken. reCAPTCHA is currently one of the few captcha systems the still work to some extend. It locks out most spam bots and keeps my sites clean. Of course it's a good idea to try and break it, to see how "secure" it is.

One thing I find works really well is context-based question captchas. You ask human visitors some very simple question about your site, and unless the robot brute-force, it's very hard for robot spammers to get it right.

Yep, I saw this in rtl-sdr.com! They ask, for instance what does the S in SDR stands for, which obviously any legitimate commenter in such a niche site knows.

I think it mostly works by inspecting your browser environment to see if it looks like a bot. I'm not really convinced that the pictures do much.

Unfortunately the latest revision of reCAPTCHA has become such a pain that I've come very close to just giving up on signing up for whatever service it is I'm trying to use that has it implemented.

I have to go through several attempts to verify myself because Google didn't like that I missed one box with a car in it and have to start all over looking for street signs.

I often use a VPN and browser extensions that make the new one always asks me to verify. The new tests are just terrible (choose all photos with an apartment building??). It will sometimes take me a few minutes to complete the test when it asks me to check all boxes with a car and the slow fade animation that takes 5 seconds starts. Then it decides that I didn't choose them well enough and starts over again. The old CAPTCHA was much better and I didn't feel like I was just feeding Google's street view.

I've found that disabling JavaScript actually makes the test easier. I often fail the js version but I rarely fail the no-js one.

Next version will ask you to come wash some cars at the Googleplex...

Yeah, it frustrates me a lot too. If I need to pick the squares with street signs about half the time they want me to choose the squares that have the pole and half not! Ditto with the square with the tiny corner of the sign.

I became really good (or really bad) at them, that once I had to go through >8< rounds of reCAPTCHA to get through....I seriously was thinking it was never going to end!

Many times I don't even get to the second step. I only click "I am not a robot" and I've passed.

Are Captcha's a paid service and my examples are sites buying into only the lowest level of ID?

Or is this something akin to a decision made vs my access frequency/behaviour where the algo decides it's reasonably sure I'm a human so no need to waste bandwidth on sending and confirming images?

If you're not asked anything after checking the box then your browser's fingerprint has already been determined to be a real human by enough partner sites using the Captcha. Try opening a private browsing window and checking the box to see the second verification part.

They're run by google, so if you're a known "good account" it just detects that you have their cookie/are logged in and lets you through. Pop it open in incognito and you should get one.

I imagine that those are hard to beat with machine learning precisely because they stump Google's own algorithms. By answering them, you're helping train their neural networks (which is why I rather resent having to answer them).

> I don't know what you call those new Google captcha

Dunno what to call them, but I consider them educational interactions with AI [0]

[0] https://xkcd.com/1897/

Reply on news.ycombinator.com